Attackers are using AI to hunt for stolen passwords and API keys.
A new global advisory from cyber insurer Chubb warns that attackers are using AI-enabled tools to find exposed credentials at scale. Here is what changed, why it matters to your business, and the four steps to take now.
Stolen credentials just got easier to find.
Stolen usernames, passwords and keys have always been one of the most common ways attackers get in. Once inside, they use those credentials to move to other systems and give themselves more access.
On November 13, 2026, Chubb issued a global advisory to its cyber insurance policyholders warning that this has accelerated. Attackers are now using AI-enabled tools and frameworks to search for exposed credentials automatically, including API keys and passwords stored in code or configuration files, and credentials pulled from the memory of running systems. Code repositories such as GitHub are being searched at scale for keys and other secrets.
Chubb is recommending that every policyholder review how credentials are secured across their environment, including cloud services, and not just once a year at renewal.
One leaked key can open the whole business.
A single exposed password or API key can give an attacker access to email, shared files, accounting systems or cloud servers, often without triggering a login alert. AI removes the time and effort that used to protect smaller businesses, because finding an exposed key now costs an attacker almost nothing.
It also matters for insurance. Carriers underwrite to these controls, and when a claim is filed they check whether the controls you said were in place actually were.
Four steps to take this month.
Based on the advisory and what we put in place for our own clients.
Lock down every user account
Turn on multifactor authentication for email, remote access and every administrator account. Move to passkeys or hardware security keys where your systems support them. Before resetting anyone's password or MFA device, confirm who they are through a channel you already trust, like a call back to a known number.
Protect sessions that are already signed in
Allow administrative work only from company-managed devices, and use encrypted, device-bound connections such as a VPN. Require IT approval before any app or AI tool is allowed to read company email or files.
Secure cloud credentials, API keys and AI connections
Give every application, vendor integration and AI tool its own identity with only the access it needs. Use short-lived credentials where possible. When a long-lived key is unavoidable, keep it in a secrets manager, assign an owner and rotate it on a schedule. Keep AI connector servers private, and require authentication if one must be reachable from the internet.
Find exposed credentials before attackers do
Scan code, deployment files and logs for passwords and keys, and block new secrets from being committed. If a key has been exposed, revoke it immediately and review what it was used to access.
We handle this for you.
Every item below is part of how we manage and protect our clients' businesses.
- MFA on email, remote access and admin accounts
- 24/7 monitored endpoint detection and response
- Company-managed devices for admin access
- Approval controls for apps and AI tools in Microsoft 365
- Email security and phishing protection
- Security awareness training and phishing tests
- Patch and vulnerability management
- Credential and secret review for your systems
- Locked-down, tested backups
- Documentation for your cyber insurance application
Common questions.
What did Chubb's November 2026 cyber advisory say?
Chubb, one of the largest cyber insurers, warned its policyholders that attackers are increasingly using AI-enabled tools to find exposed credentials at scale. That includes passwords, API keys and cloud credentials left in code, configuration files, code repositories like GitHub, or pulled from the memory of running systems.
Are small businesses really a target?
Yes. AI lets attackers scan the internet and code repositories automatically, so they no longer need to pick targets by hand. Any business with an exposed password or key can be found, regardless of size.
What is an API key and why does it matter?
An API key is a password that lets one application talk to another, for example your accounting software to your bank or a website to your email system. If one leaks, an attacker can often reach your data without ever logging in as a person, and MFA does not protect it.
Does multifactor authentication stop these attacks?
MFA stops most attacks that use a stolen user password, which is why it should be on email, remote access and every admin account. It does not protect API keys, service accounts or sessions that are already signed in, so those need their own controls.
Will my cyber insurance require these controls?
Increasingly, yes. Insurers already ask about MFA, endpoint protection, backups and privileged access on applications and renewals. Advisories like this one show where underwriting is heading next: credential storage, AI tool access and secret scanning.
Source: Chubb Cyber, "Credential Security Advisory: Defending Against AI-Enabled Threats," issued to policyholders November 13, 2026. This page is JK Computer Solutions' summary and guidance and is not affiliated with or endorsed by Chubb. Learn more at chubb.com.
Not sure where your business stands?
Take our free 2-minute security checklist, or book a 15-minute Teams call with our team.